.svg)
.svg)
Last updated: 15 July 2026
Assemble You Limited understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone who visits this website, https://www.assembleyou.com/ ("our Site") and will only collect and use your personal data as described in this Privacy Policy and as permitted by law.
Please read this Privacy Policy carefully and ensure that you understand it. Your acceptance of this Privacy Policy is implied by using this website and/or the licensed content system ("System").
Our Site is owned and operated by Assemble You Limited, a limited company registered in England and Wales under company number 13136109.
The System is owned by Kwantic Limited, a limited company registered in England and Wales under company number 14665130 and is made available to Assemble You Limited under license.
This Privacy Policy applies to your use of our Site, the System, the personalised proposal and course-preview pages we host (for example at demo.assembleyou.com), and the delivery of our "connector" course content from content.assembleyou.com to courses hosted in other learning platforms. Our Site and the System may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the privacy policies of any such websites before providing any data to them.
Personal data is defined by the UK GDPR and the Data Protection Act 2018 (collectively, "the Data Protection Legislation") as "any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier".
Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:
For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided in Part 10. If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner's Office. We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first, using the details in Part 10.
Subject to the following, we do not collect any personal data from you unless you provide it.
When you sign up for a free trial or contact us, we may collect:
Cookies and similar technologies. Our Site uses cookies and similar technologies to collect certain data, which includes your IP address, browsing behaviour, and other technical information. An IP address is personal data under the Data Protection Legislation. Our consent banner is provided by Cookiebot (Usercentrics A/S). Except for the statistical measurement for UK visitors described below, non-essential cookies and tracking technologies are only used where you have given consent through the banner, in line with the Privacy and Electronic Communications Regulations (PECR). You can change your choices at any time via the cookie settings link, and the full list of cookies we use is published in the cookie declaration on our Cookies page.
Analytics and statistical measurement. We use Google Analytics 4 (Google Ireland Limited) to measure how our Site is used, and Contentsquare (Contentsquare SAS) to understand how visitors interact with our pages, through pseudonymised, aggregated session analytics and heatmaps. Contentsquare is configured for statistical purposes only and its data is not used for advertising.
For visitors in the United Kingdom: from 5 February 2026, the Data (Use and Access) Act 2025 amended PECR to permit cookies used solely for statistical purposes without prior consent, provided we tell you clearly and give you a free way to opt out. We rely on this exception to run Contentsquare by default for visitors in the UK. You can opt out at any time using the cookie banner or the cookie settings link on any page, and we will stop the measurement immediately. For visitors outside the UK, Contentsquare only runs with your consent. Google Analytics always requires consent: if you decline or have not yet chosen, Google receives only aggregated, cookieless signals (Google Consent Mode) that are not linked to you as an individual.
Advertising and marketing technologies (consent only). With your consent, our Site uses: the Meta Pixel and Meta Conversions API (Meta Platforms Ireland Limited) for advertising measurement and audience building; the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) for advertising measurement; Google Ads conversion tracking (Google Ireland Limited); HubSpot tracking (HubSpot, Inc., EU data centre), which connects your visits to the record we hold about you in our customer relationship management system; and Klaviyo on-site tracking (Klaviyo, Inc.), which connects your visits to our email newsletter records if you are a subscriber. None of these technologies run unless you accept them via the cookie banner, and declining or withdrawing consent stops them.
Campaign attribution without cookies. If you arrive at our Site from a link that carries campaign parameters (for example utm_source), we keep those parameters in your browser's sessionStorage for the duration of your visit and re-attach them to page addresses as you browse, so that if you choose to submit a form we can record which campaign brought you to us. This mechanism stores no identifier about you, is not shared with third parties, and is deleted automatically when you close the tab.
Video playback. Videos on our Site are served by Vimeo (Vimeo.com, Inc.). If you have not given marketing consent, videos play in Vimeo's Do-Not-Track mode, which sets no cookies and sends no tracking data to Vimeo beyond what is technically necessary to play the video.
Data collected automatically. Our Site collects certain information automatically, including your IP address, the type of browser you are using, and certain other technical data about your computer or device such as your operating system type or version, and display resolution.
If you email us, we may collect your name, your email address, and any other information you choose to give us. For the purposes of the Data Protection Legislation, we are the data controller responsible for such personal data. In the context of your use of the System, personal data made available to Assemble You will be limited to an email address. Alternatively, Assemble You Limited may elect to deploy a pseudonymised access code system to facilitate access to the System.
When we send you a personalised proposal, we host it on a private web page. To view it, we ask you to enter your name and work email address. Once you have done that, we record how you engage with the page so that we can follow up in a relevant and timely way.
What we collect. When you open one of these pages and enter your details, we record:
We create a one-way cryptographic hash of your email address and use it as the reference key for your record, so that repeat visits from the same email are recognised as one person rather than several. This is a technical measure, not anonymisation: we still hold your email address in readable form.
We do not place a persistent tracking cookie or a persistent identifier on your device for this purpose. A short-lived marker in your browser's session storage lasts only until you close the tab and exists solely to avoid asking you to re-enter your details within the same visit.
Why we collect it, and our lawful basis. We process this data for our legitimate interests (UK GDPR Art. 6(1)(f)) in running an efficient business-to-business sales process: understanding whether the material we send has been received and found useful, prioritising follow-up, and tailoring our conversations to what interested you. We have carried out a balancing assessment and concluded that this processing does not override your interests or rights, in particular because the data relates to you in a business capacity, is limited in scope, includes no special-category data, and is not used to make any automated decision that produces a legal or similarly significant effect. You can ask us for a copy of that assessment, and you can object at any time (see Part 4).
Who sees it. Access is limited to Assemble You's sales and founder team. The data is disclosed to Slack (our internal messaging tool) and Google (which hosts the database). See Part 8 for detail on these recipients.
Some of our courses are licensed to organisations and hosted inside their own learning management system (for example Cornerstone), rather than on our Site or the System. Where a course is one of our "connector" packages, it loads its content (audio, video, images, and captions) from our hosting at content.assembleyou.com while a learner is taking it. When it does so, our hosting provider automatically receives that learner's IP address and browser type (user-agent) as a normal part of serving the content. We do not receive the learner's name, and we do not receive their course results; completion and score data stay within the learning platform that hosts the course.
Where we deliver course content in this way under an agreement with the organisation, that organisation is the controller for its learners' personal data and we act as its processor for content delivery. Separately, the logs generated by our hosting provider, which contain the IP address and user-agent, are processed by us as controller for the security and reliable operation of our hosting, on the basis of our legitimate interests (UK GDPR Art. 6(1)(f)). This content is served through Netlify, a US provider operating a globally distributed content delivery network. Where personal data is transferred to a third country we rely on an appropriate Article 46 safeguard, as described in Part 7.
The lawful basis under the Data Protection Legislation that allows us to use information arising from your use of our Site is Article 6(1)(f) of the UK GDPR (legitimate interests), in this case the proper operation and functionality of our Site and the engagement tracking described above. Statistical measurement for UK visitors relies on our legitimate interests together with the PECR statistics exception introduced by the Data (Use and Access) Act 2025. All consent-based technologies listed above rely on your consent (Article 6(1)(a)), which you can withdraw at any time.
If you contact us or request a free trial as described above, our lawful basis for using your personal data to respond to you and to follow up about your enquiry or trial is Article 6(1)(f) of the UK GDPR (legitimate interests), namely our interest in dealing with your enquiry and exploring whether our services are of interest to you. You can object to this follow-up at any time (see Part 4), and where we contact you by electronic means we do so in accordance with our obligations under PECR.
The lawful basis for the processing of your personal data pertaining to your use of the System is Article 6(1)(a) of the UK GDPR (consent) and, where processing is necessary to give you access to the System under our agreement with you, Article 6(1)(b) of the UK GDPR (performance of a contract). Kwantic Limited hosts the System and processes this personal data only as our processor, acting on our documented instructions under a data-processing agreement (Article 28 UK GDPR), and not for its own purposes.
Where we collect any personal data, it will be protected and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. See Part 7 for our retention criteria.
We may use your personal data to:
We will comply with our obligations and safeguard your rights under the Data Protection Legislation at all times. For more details on security and storage, see Part 7. We will not share any of your personal data with third parties other than as described in this Privacy Policy.
Security. We take appropriate technical and organisational measures to keep your personal data secure, including access controls, encryption in transit, and restricting access to authorised personnel (Art. 32 UK GDPR).
Retention. We keep personal data no longer than is necessary for the purpose for which it was collected. The criteria we use to set retention periods are the duration of our relationship with you, any ongoing legitimate interest in following up, and any legal or accounting obligation to retain records. Our current retention periods are:
| Data | Purpose | Retention period |
|---|---|---|
| Enquiry and contact data (name, email, phone) | Responding to and following up on enquiries | 24 months from our last contact with you |
| Newsletter and marketing data (Klaviyo) | Sending the newsletter and marketing you have consented to | Until you unsubscribe; we then keep a minimal suppression record so that we do not contact you again |
| System / trial access data (email or access code) | Providing access to the System | Duration of access, then 12 months |
| Website analytics (Google Analytics 4) | Understanding and improving Site use | Up to 14 months |
| Session analytics (Contentsquare) | Understanding and improving Site use (statistical purposes only) | Up to 13 months |
| CRM records (HubSpot) | Managing enquiries, sales conversations and customer relationships | Duration of our relationship, then reviewed and deleted after 24 months of inactivity |
| Consent records (Cookiebot) | Evidencing your cookie choices | 12 months from your choice, after which you are asked again |
| Proposal page engagement events (section views, dwell, resource clicks) | Sales follow-up | 12 months from the event, then deleted |
| Proposal page viewer summary (name, email, visit totals) | Sales follow-up | We delete it when it is no longer needed for follow-up, or on request |
Backups are included in this schedule and are overwritten in the ordinary course of our backup cycle.
Storage location and international transfers. Your personal data is stored within the UK and the European Economic Area where possible. The database used for proposal engagement tracking is hosted in Google's europe-west2 region (London, United Kingdom), and our CRM data is held in HubSpot's EU data centre.
Some of our providers are internationally operated, so certain personal data may be transferred to or accessed from countries outside the UK ("third countries"), including the United States. Where personal data is transferred to a third country, we ensure an appropriate safeguard under Article 46 of the UK GDPR is in place: where the provider is certified under the UK Extension to the EU-US Data Privacy Framework we rely on that certification, and otherwise we use the ICO's International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional measures identified by a transfer risk assessment.
We will not share any of your personal data with any third parties for any purpose, subject to the following exceptions.
We share personal data with the following categories of recipient, who process it on our behalf, or who receive it as part of providing a service to us:
If any of your personal data is transferred to a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party's obligations under the law, as described in Part 7.
If we sell, transfer, or merge parts of our business or assets, your personal data may be transferred to a third party. Any new owner of our business may continue to use your personal data in the same way(s) that we have used it, as specified in this Privacy Policy (i.e. to communicate with you). In limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.
Business development. We identify potential business customers and contact them in a professional capacity, including through professional networking platforms such as LinkedIn, where we may send a connection request and a message. Where we do this, we process professional information such as your name, job title, employer, and the details available on your public professional profile. Our lawful basis is our legitimate interests (Article 6(1)(f) UK GDPR) in developing business-to-business relationships. Where we have obtained your details from a professional networking platform or another public source, we will make that clear when we first contact you, and you can ask us to stop at any time by contacting us at support@assembleyou.com.
Legal grounds for processing. Where we rely on legitimate interests, this is based on our legitimate interest in operating and improving our Site and in developing our business. We may process your personal data on more than one lawful ground depending on the purpose for which we are using it. Please contact us at support@assembleyou.com if you need details of the specific ground we are relying on.
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a "subject access request".
All subject access requests should be made in writing and sent to the email or postal addresses shown in Part 10. There is not normally any charge for a subject access request. If your request is "manifestly unfounded or excessive" (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.
We will respond to your subject access request within one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.
To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following:
We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.
Any changes will be immediately posted on our Site and you will be deemed to have accepted the terms of the Privacy Policy on your first use of our Site and/or the System following the alterations. We recommend that you check this page regularly to keep up-to-date.
This Privacy Policy was last updated on 15 July 2026.